Automattic Wordpress Update Version 7.0.3
Views
12
Your rating
Rate update installation process
Log in to rate this update.
Login
Risk factor
No ratings yet. Be the first to rate this update.
Smooth installs
0%
Minor issues
0%
Major issues
0%
AI enhanced content
Update Summary
WordPress 7.0.3 is a security release addressing multiple cross-site scripting, privilege escalation, information disclosure, SSRF, and other vulnerabilities, including CVE-2026-64638 and GHSA-52p2-r8wf-jcrf.
Update Details
Security
- Pre-auth reflected XSS on the login screen with potential PHP code execution, documented as CVE-2026-64638 and GHSA-52p2-r8wf-jcrf.
- Contributor+ stored XSS vulnerabilities in the emoji settings element, Post Content block, Quick Edit, and Post Date block.
- Privilege escalation on multisite networks with user registration enabled, allowing users to create new sites.
- Information disclosure in the Latest Comments block exposing comments on password-protected posts.
- Post slug enumeration and disclosure of notes in comment feeds.
- Author+ CSS injection caused by bypassing the safe CSS attribute filter.
- Bypass of the email address confirmation flow.
- SSRF in URL validation allowing requests to link-local ranges.
Hints
- Update from the WordPress Dashboard under Updates by selecting Update Now, or download WordPress 7.0.3 from WordPress.org.
- Sites supporting automatic background updates will begin updating automatically.
- Applicable security fixes are being backported to security-supported branches through WordPress 4.7.
- WordPress 7.1 RC2 includes all applicable fixes from this release.
Product Information
Vendor: Automattic
Product: Wordpress
Product type: Software
Platform: Web
Version: 7.0.3
Vendor information published: Aug 6, 2026
Original release notes: View on vendor site
Published on updatealert.io: Oct 24, 2026
Description: WordPress is a free and open platform for creating websites and blogs.